Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

社区运营小助手

v1.3.2

有赞口碑圈商家运营自动化技能。用于口碑圈发帖(文字/图片/视频/商品)、活动管理、数据监控、自动提醒、长连接推送。使用场景:商家需要在口碑圈发布内容、管理社区互动、查看运营数据、配置自动任务时触发此技能。需要商户 Key 才能执行操作。

0· 99·0 current·0 all-time
byKoubei_Quan@quanceng666

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for quanceng666/koubei-circle-operator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "社区运营小助手" (quanceng666/koubei-circle-operator) from ClawHub.
Skill page: https://clawhub.ai/quanceng666/koubei-circle-operator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install koubei-circle-operator

ClawHub CLI

Package manager switcher

npx clawhub@latest install koubei-circle-operator
Security Scan
Capability signals
CryptoRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to be a Koubei (有赞口碑圈) operator and the included CLI implements publish, query, upload, and SQL query functions that align with that purpose. However: (1) the SKILL metadata declares no required credential or config, while the documentation and CLI require a merchant API Key and a host; (2) package.json lists a scripts/package.js binary that is not present in the file manifest (broken/misconfigured); (3) SKILL.md says current version only supports text posts, yet the CLI contains image/video upload functions — an internal inconsistency. These mismatches reduce confidence the packaging and declarations are correct.
!
Instruction Scope
SKILL.md explicitly instructs the AI to ask the user for the merchant Key and to 'silently' run `node scripts/openclaw.js init --key {{key}}` to validate and save it. That runtime instruction causes the agent to transmit the user's secret to an external host for validation and to persist it locally in scripts/config.json. The instructions also forbid calling the API directly and demand all API calls go through the included CLI, centralizing the secret in the skill. 'Silent' transmission of secrets and persisting them without explicit user confirmation is a scope/privacy concern.
Install Mechanism
There is no external install spec or downloads — this is an instruction + bundled code skill, which is lower install risk. The included scripts perform network I/O and file writes. The package metadata appears slightly broken (missing scripts/package.js referenced in bin), which suggests sloppy packaging but not necessarily malicious installation behavior.
!
Credentials
The skill requires a merchant API Key to operate (documented in SKILL.md and used by scripts/openclaw.js), but the skill metadata does not declare this as a required credential or primaryEnv. The CLI will send this key on every API request by adding it as a query parameter. Critically, the default host in scripts/config.json is https://ocg.myfans.cc — a third‑party domain that is not documented as an official Youzan/口碑 endpoint in SKILL.md. This means your merchant Key would be transmitted to and used by that host; that is disproportionate unless you explicitly trust that domain and its operator.
Persistence & Privilege
The skill writes the provided Key to scripts/config.json (the CLI's local config) and will read it back for subsequent operations. always is false and there is no evidence it modifies other skills or global agent settings. Persisting a secret to the skill's config is expected for CLI tools, but combined with the 'silent' init behavior and external host it increases the privacy risk.
What to consider before installing
This skill will ask you to paste your Koubei/merchant API Key and will silently send it to the configured host (default: https://ocg.myfans.cc) and save it to scripts/config.json. The registry metadata does not declare the key requirement, and the host is not identified as an official Youzan endpoint — so you should NOT provide a production/high-privilege key unless you trust the skill author and host. Before installing: (1) ask the publisher for a verifiable homepage or source and confirmation that ocg.myfans.cc is an official/authorized API gateway; (2) review the full scripts/openclaw.js to confirm where the key is sent and how it is stored; (3) consider running the skill in an isolated/sandbox environment and using a limited-scope or test merchant Key; (4) avoid 'silent' configuration — require explicit confirmation before saving/transmitting secrets; (5) fix/confirm package.json inconsistencies (missing files) or prefer a well-maintained upstream package. If you cannot verify the host or author, do not install or provide sensitive keys.

Like a lobster shell, security has layers — review code before you run it.

latestvk97exztwmp66bhzeen68tq5j7s859emk
99downloads
0stars
7versions
Updated 6d ago
v1.3.2
MIT-0

口碑圈运营助手 (Koubei Circle Operator)

当前版本: v1.3.2


⚠️ 首次使用必读

安装完成后,请按以下步骤完成首次配置:

第 1 步:获取商户 Key

  1. 登录 有赞商家后台
  2. 进入 「口碑圈」 应用
  3. 找到 「商户 Key」(或「API Key」)
  4. 点击复制

第 2 步:在 OpenClaw 中配置

按顺序执行以下操作:

  1. 点击 AI 助手
  2. 点击 openclaw 小助手
  3. 发送以下指令到 OpenClaw:
    我复制好口碑圈 Key 了,帮我配置
    
  4. 调用以下指令到 OpenClaw:
    node scripts/openclaw.js init --key {{key}}
    

注意:首次使用必须完成 Key 配置,否则无法使用任何功能。

配置成功后,你可以:

  • 📝 发布文字贴、图片贴、视频贴
  • 📊 查询用户数据、帖子数据、活动数据
  • 📈 查看运营报表
  • 📬 批量发送站内信/私信
  • ⚙️ 配置自动化任务

AI 配置流程(重要)

当用户说"帮我配置口碑圈"或"我复制好 Key 了"时,AI 必须按以下流程执行:

步骤 1:获取 Key 并验证(静默执行)

  1. 请用户提供商户 Key(从有赞商家后台复制)
  2. 用户提交 Key 后,AI 必须静默调用 node scripts/openclaw.js init --key {{key}} 完成验证和保存
    • 验证 Key 有效性
    • 保存到配置文件

步骤 2:确认配置成功

直接告知用户配置已完成,并说明可以使用的功能:

  • 📝 发布文字贴、图片贴、视频贴
  • 📊 查询用户数据、帖子数据、活动数据
  • 📈 查看运营报表
  • ⚙️ 配置自动化任务

使用方式

所有操作请直接与 AI 对话完成,无需手动运行命令。

你想做什么对 AI 说
配置商户 Key"我复制好 Key 了"
发布文字贴"帮我发个帖子"
查看用户列表"看看有哪些用户"
查看话题列表"有哪些话题"
导出数据到 Excel"把数据导出成 Excel"
批量发送站内信"请给XX活动的点赞前3名发送站内信,消息内容是..."
自动化任务"今天10点时告诉我社区的发贴数量"

使用约束(重要)

接口调用约束

  • 所有接口必须通过 openclaw.js 调用
  • ✅ 任何中文必须使用UTF-8字符集
  • ❌ 禁止直接调用 API 接口
  • ❌ 禁止绕过 CLI 工具访问后端服务

ID 展示约束

  • 禁止直接向用户展示原始 ID
  • ✅ 查询结果必须关联显示名称(用户昵称、话题名称等)
  • ✅ 任何 ID 字段都应关联查询对应的名称信息

示例

  • ❌ 错误:这个帖子的 author_id 是 12
  • ✅ 正确:这个帖子的作者是 张三(user_id: 12)

数据查询约束

  • 严格按用户要求的时间范围查询
  • ✅ 用户查"今天" → SQL 必须加今天的时间条件
  • ✅ 用户查"昨天" → SQL 必须加昨天的时间条件
  • 禁止返回非要求时间的数据

帖子审核状态约束

  • 默认只查询审核通过的帖子(audit_status=1)
  • ⚠️ 回复包含非通过状态的帖子时,必须告知用户审核状态
audit_status状态
0未审核
1审核通过
2审核拒绝

SQL 查询限制

  • ❌ 禁止使用 SELECT *
  • ❌ 禁止查询未开放的字段
  • ❌ 禁止使用 forum_id 字段
  • ⚠️ LIMIT 最大 500

发帖流程(重要)

普通发帖

  1. 确认帖子类型

    • ⚠️ 当前版本仅支持文字贴(type=1
    • 如用户提供图片/视频,告知暂不支持
  2. 执行发帖:调用 node scripts/openclaw.js publish

{
  "type": 1,
  "title": "标题",
  "message": "内容",
  "attachment_list": []
}
  1. 禁止测试验证:发帖成功后,不要再次查询验证,避免重复发帖

热议话题发帖

  1. 查询马甲列表供用户选择
  2. 查询热议话题列表供用户选择
  3. 用户选择后调用 node scripts/openclaw.js publish-hot
{
  "user_id": 0,
  "type": 1,
  "hot_say_id": 8,
  "title": "标题",
  "message": "内容"
}

使用前提

  1. 已开通有赞口碑圈服务
  2. 已获取商户 Key
  3. 已创建至少一个圈子

数据导出到 Excel

当用户需要导出查询数据时,引导安装 excel-xlsx 技能:

请先安装 excel-xlsx 技能(通过 SkillHub 商店)

注意事项

  • 商户 Key 需保密存储
  • 遵守平台内容发布规则
  • 部分功能需旗舰版及以上版本

详细文档

Comments

Loading comments...